Privacy Policy
Last updated: October 7, 2026
This policy explains what personal information Data Atlas collects, why, how it is stored and shared, and the choices you have. It applies to the website at data-atlas.net, the application at data-atlas.net/app, and the public forms published through it.
1. Who is responsible
Data Atlas is operated from Newfoundland and Labrador, Canada. For anything in this policy, write to contact@data-atlas.net.
Two roles matter here. For your account and your use of the service, Data Atlas is the data controller. For the answers people submit to forms you publish, you (or your organization) are the controller and Data Atlas processes them on your behalf.
2. What we collect
Account information
When you sign in with Google or GitHub we receive your name, email address, the provider's identifier for you, and, if the provider offers one, your profile picture. We do not receive your password.
What you create
Forms, their version history, campaigns, organizations, teams and their members' email addresses, and the settings you choose. If you connect a Google account for Sheets delivery, we store an encrypted token that lets us write to the spreadsheet you picked. Google's consent screen asks for two permissions: access to files created or opened through Data Atlas, and permission to see and edit your Google Sheets. We use them only to write submissions to the spreadsheets you choose as destinations, and you can revoke them in the app or in your Google account at any time.
Submissions to your forms
Whatever respondents enter, including uploaded files, the time of submission, and which A/B variant they were shown. Files are checked for type and size before storage.
Documents you upload for processing
If document processing is enabled for your organization, the PDFs and spreadsheets you upload, the text and layout extracted from them, and the classifications and corrections you make.
Trackers
On the Team plan, a tracker researches a topic you describe on a schedule you choose. We store the topic, the concept you agree with the research agent, its reports, the web pages it read (with their dates and a copy of what they said when read), and the figures it recorded. If you add places, we store their names, addresses and map coordinates. When you choose Use my location, your browser asks first; we turn the position into an address once, store that place, and do not track your location.
Billing
Purchases are made through Lemon Squeezy, our merchant of record. We store the plan, its status and period, and Lemon Squeezy's identifiers for the customer and subscription. We never see or store card numbers.
Technical and usage information
Server logs record request paths, status codes and timing for reliability and security. If you allow analytics cookies, PostHog records the pages and features you use, your browser and device type, and an anonymous identifier. After sign-in that identifier is linked to your account, and your name and email address are sent with it so we can tell who is using what. On a form you fill in for someone else, PostHog does not record what you click, so your answers are never sent to it. If your browser blocks something on our pages under our security policy, it may send PostHog a report naming the page and what was blocked. Session replay is switched off. Without your permission PostHog is only used to deliver feature flags and stores nothing in your browser. See the cookie policy.
3. How we use it
- To run the service: sign you in, save your work, publish campaigns, deliver submissions to the destinations you set up, and bill your organization.
- To keep it secure: detect abuse, verify uploads, and investigate incidents.
- To improve it: understand which features are used, when you have allowed analytics.
- To answer you when you write to us.
We do not sell personal information and we do not use it for advertising.
4. Legal basis
Where the GDPR or UK GDPR applies: performance of our contract with you (running the service and billing), our legitimate interests (security, reliability, and answering you), your consent (analytics cookies, which you can withdraw at any time), and legal obligations (tax and accounting records kept by our merchant of record).
5. Who we share it with
We share personal information only with the providers that run the service:
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting, the API, and file storage | United States |
| Neon | The database | United States |
| Google and GitHub | Sign-in; Google also for Sheets delivery you set up | United States |
| Lemon Squeezy | Payments, invoices and tax, as merchant of record | United States |
| PostHog | Feature flags, and analytics if you allow it | United States |
| Resend | Submission notification emails, when they are switched on | United States |
| Anthropic | The research agent behind trackers: the topic, concept and places you give it, and the pages it reads | United States |
| Mapbox | Finding a tracker's places on the map, from the addresses or positions you add | United States |
| Amazon Web Services and Google (Gemini) | Text extraction and classification for document processing, when enabled | United States |
We will also disclose information when the law requires it, or to protect the rights and safety of Data Atlas, its users, or others.
If you connect a Google account, our use of information received from Google APIs follows the Google API Services User Data Policy, including its limited-use requirements.
6. International transfers
The service is operated from Canada and hosted in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to those countries under the providers' standard contractual clauses and equivalent safeguards.
7. How long we keep it
- Account, forms, campaigns and submissions: for as long as your account exists. Deleting a form deletes its campaigns, submissions and uploaded files. A campaign that has collected submissions cannot be deleted on its own, so its answers are removed with the form.
- Documents uploaded for processing: until you delete them; deletion removes the derived text and files as well.
- Billing records: as long as our merchant of record must keep them for tax law.
- Server logs: a short period for security and reliability.
- Analytics: PostHog's retention for your project, and only while you allow it.
To delete your account and everything in it, write to us.
8. Cookies
Essential cookies keep you signed in and remember which A/B variant a respondent saw. Analytics cookies are set only if you allow them. The full list, with lifetimes, is in the cookie policy, where you can also change your choice.
9. Your rights
Depending on where you live you may have the right to access the personal information we hold about you, to correct it, to have it deleted, to receive a copy in a portable form, to object to or restrict certain processing, and to withdraw consent. Under Canada's PIPEDA you may also challenge our compliance with it. To exercise any of these, write to contact@data-atlas.net; we answer within thirty days. You may also complain to your local data protection authority, or in Canada to the Office of the Privacy Commissioner.
If your information was submitted to a form published by one of our users, please contact that user first; we will help them respond.
10. Security
Connections are encrypted in transit. Session cookies are HTTP-only and, in production, secure. Google tokens are encrypted at rest. Uploaded files are stored privately and served only to people with access to the form. No system is perfectly secure; if we learn of a breach affecting you we will tell you as the law requires.
11. Children
Data Atlas is not directed at children under 16 and we do not knowingly collect their information. Users who publish forms are responsible for the audiences they collect from.
12. Changes
We will post changes here and update the date at the top. For material changes we will also tell signed-in users in the app.
13. Contact
Data Atlas, Newfoundland and Labrador, Canada. contact@data-atlas.net